Production runs on Hetzner Kubernetes (K3s) with Argo CD.
Pipeline
Push main → GitHub Actions (lint / build / docker)
→ ghcr.io/halort/<service>:<sha>
→ CI pins image tag in deploy/.../kustomization.yaml
→ Argo CD syncs
| Layer | Where |
|---|---|
| Terraform (Hetzner + Cloudflare) | halort-infra/terraform/ |
| K3s bootstrap | halort-infra/bootstrap/ |
| Platform addons (ingress, cert-manager, …) | halort-infra/gitops/platform/ |
| Argo Applications | halort-infra/gitops/root/ |
| Per-service manifests | each repo deploy/kubernetes/apps/<service>/ |
Argo UI: https://argocd.halort.com
DNS
npm run dns:k8s in halort-infra upserts Cloudflare A records for production hosts (including docs.halort.com) and *.halort.com → Hetzner LB. See Ops/DNS and Domains.
Secrets
Runtime secrets stay in the cluster (not Git): e.g. halort-platform-runtime-env, halort-web-runtime-env, halort-notification-runtime-env, GHCR pull secret. Helpers: make sync-ghcr-pull, make sync-platform-secrets, etc. See Ops/Secrets Overview.
CI dashboard
From halort-infra: npm run ci monitors Actions + Argo for web, platform-web, platform, design-system, docs, notifications, infra.